Tweet
Tweet

Slide 1

Slide 1 text

An Unexpected Journey How I learnt to ❤ security and thrived Akash Mahajan @ Expert Masterclass | Mar 2021

Slide 2

Slide 2 text

Akash Mahajan ★ Co-Founder Kloudle, Appsecco, null.community ★ Published Author of Burp Suite Essentials, Security Automation using Ansible ★ Trainer BlackHat, nullcon, c0c0n ★ Technical Reviewer of books/conferences ○ Terraform Up and Running - Book ○ DefCon Cloud Village, Recon Village (2019-20) ○ PyCon India 2020

Slide 3

Slide 3 text

From Coder to Company Creator

Slide 4

Slide 4 text

I want to talk about the future “3 huge shifts taking place in the tech world; platforms, app dev and therefore security”

Slide 5

Slide 5 text

PLATFORM SHIFTS 3 Tier to Cloud Native Apps & IaaS to CaaS 5 Monoliths to Microservices Virtual Machines on IaaS to Containers on Kubernetes

Slide 6

Slide 6 text

6 Waterfall DevOps Cloud-Native Ops Cloud Native Developer Head Platforms & CloudNative APP LIFECYCLE SHIFT Redefined Roles IT Admin/App Dev turned into DevOps Head of DevSecOps/SRE Enterprise App Developer AppSec Pentester

Slide 7

Slide 7 text

7 Event & data driven security Perimeter based Application Security in Virtual Machines with traditional network and web application firewalls SECURITY ARCHITECTURE SHIFT Perimeter to Data Centric Security Events & Data Firewalls (Network/WAF) Port/Service Allowed API access (HTTPs)

Slide 8

Slide 8 text

What is covered when we say Cloud Native

Slide 9

Slide 9 text

Cloud Native Security requires ★ DevSecOps + DevOps working together ★ Immutable Infrastructure for production, usually achieved by Infra as Code (IaC) ★ Continuous Deployment pipelines for infrastructure and code and supporting services ★ Event Driven Security to enable automation for monitoring and response

Slide 10

Slide 10 text

Learn for the cloud ★ To setup Virtual Machines with CLI (AWS, Azure, GCP) and with code (Terraform, AWS CDK, Pulumi) ★ Learn using Just in Time security for eg. enable port access using API based on events & triggers ★ Learn deploying complete applications with databases as Docker on VMs and managed services like AWS Fargate, Google Cloud Run ★ Write asynchronous event based cloud functions in Python/NodeJS/Golang for Functions as a Service

Slide 11

Slide 11 text

Go in depth Day2 ops for SREs ❏ Secure access to production ❏ How to deploy source code to app using CI/CD ❏ How to do encrypted backups ❏ How to manage vulnerabilities ❏ How to alert, notify and respond ❏ How to define Service Level Objectives

Slide 12

Slide 12 text

Freshers do 3 things now! 2 3 1

Slide 13

Slide 13 text

@makash https://linkedin.com/companies/kloudle @kloudleinc http://linkedin.com/in/akashm